The Pulse
WIRED Traces Hundreds of Apps and Sites to Hidden Deepfake Tools
WIRED found more than 400 connected apps and websites that appeared to offer ordinary AI services but could load tools for generating sexually abusive images and videos. Apple and Google removed apps, while Meta said the domains were linked
AI.info Team · Written with AI · fact-checked ·
More than 400 connected apps and websites presented as ordinary AI services could conceal tools for generating sexually abusive deepfakes, a WIRED investigation published November 2 found. Apps advertised for pet portraits, language tuition or workout coaching could, under certain conditions, load a web interface that turns uploaded photos into explicit images and videos. Researchers traced the network after investigating links from video ads on Meta’s Facebook and Instagram.
A pet-portrait app with a second purpose
Viefur, marketed as an AI pet-portrait maker, sells digital coins for transformations such as putting a cat in a Hawaiian shirt. WIRED found that the app also connects to a hidden generator for sexually abusive images. The investigation found templates depicting sexual violence and threats, including a scenario in which a man holds a knife to a woman’s neck.
The hidden function does not appear in the same way for every user. Paul Bouchaud, a lead researcher at the nonprofit AI Forensics, told WIRED that an app contacts a server with information such as the user’s location, language and a unique identifier; the server then determines whether to show the explicit or ordinary version.
“Each time the application is downloaded, there is a call to the server with some information, such as where the user is coming from, the language, some unique identifier, and then the server replies whether or not to show the explicit or the non-explicit version of it,” explains Paul Bouchaud, a lead researcher at AI Forensics.
Researchers said there was no clear list of reasons why a user might see the explicit version, but one possible trigger was downloading an app after clicking an associated ad on Meta’s platforms.
Hundreds of listings, linked code
The apps’ websites often showed a blank screen, while code behind them contained a list of related domains, app details, encryption keys and Facebook advertising trackers. WIRED reported that Infoblox researcher Maël Le Touz identified almost 500 linked domains. Describing the code, Le Touz said: “They contained this giant configuration list of other domains with different encryption keys. They run the same code and they all reference one another.”
Bouchaud’s analysis of domain registrations found that the apps began appearing toward the end of 2025, with a spike in spring 2026. At one point, about 30 nudify apps and websites were being registered each week. In September, 27 were live on Google Play; together, they had more than 350,000 downloads, and many were rated suitable for all age groups, according to the research cited by WIRED.
One app, DiffAI, had more than 100,000 Play Store downloads after its creation in December 2025. A store review warned that it offered templates for child sexual abuse material and other pornography, and said it did not verify users’ ages. Google removed DiffAI shortly before WIRED contacted the company. WIRED reported that Google had already removed most of the apps before that inquiry.
Apple and Meta describe removals
Apple removed 19 apps, including Viefur, after WIRED shared information about the activity and associated domains. Apple spokesperson Adam Dema said the apps complied with the company’s rules when reviewed. He attributed the later changes to their developers:
“After approval, their developers changed the website the app pulls its content from, replacing what we approved with pornographic content, and promoted it through pornographic ads hosted on a third-party platform,” says Apple spokesperson Adam Dema.
Apple said it had suspended tens of thousands of apps for similar “bait-and-switch” tactics over the previous year.
Meta said it had banned KeLing Technology Limited from advertising in 2025 after the company failed to comply with a cease-and-desist letter. After WIRED shared more than 400 domains with Meta, the company’s spokesperson said they had shared more than 3,000 associated ads linked to them, two-thirds of which Meta had already removed from its systems. Meta later told WIRED it had taken action against 11,600 ad accounts, more than 4,700 business pages, 5,200 users and 15,000 pages linked to the domains, and had blocked 209 apps from advertising on its platforms.
Similar ads and apps continued to appear
WIRED linked the app network to Chinese-language developers and the Hong Kong-registered company KeLing Technology Limited, based on domain records and how the services operated. Email addresses associated with KeLing, the apps and related services did not respond to WIRED’s requests for comment. After the inquiries, some public links to KeLing were removed or renamed.
Meta said the operators used fake identities and increasingly deceptive methods to evade detection, and said it acts on ads when it becomes aware of them. As WIRED finished reporting, similar ads and apps continued to appear on the tech platforms.